Bug 421141 (CVE-2007-6318)

Summary:	CVE-2007-6318 wordpress: SQL injection when certain DB charsets are used
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	John Berninger <john>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	adrian, security-response-team, vdanen
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6318
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-04-09 21:16:49 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Tomas Hoger 2007-12-12 09:45:13 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2007-6318 to the following vulnerability:

SQL injection vulnerability in wp-includes/query.php in WordPress
2.3.1 and earlier allows remote attackers to execute arbitrary SQL
commands via the s parameter, when DB_CHARSET is set to (1) Big5, (2)
GBK, or possibly other character set encodings that support a "" in a
multibyte character.

References:
http://www.securityfocus.com/archive/1/archive/1/484828/100/0/threaded
http://www.abelcheung.org/advisory/20071210-wordpress-charset.txt
http://www.securityfocus.com/bid/26795
http://www.frsirt.com/english/advisories/2007/4172
http://secunia.com/advisories/28005
http://xforce.iss.net/xforce/xfdb/38959

Comment 1 Tomas Hoger 2007-12-12 09:52:25 UTC

This problem does not affect default configuration, it only affects
configurations with certain database character sets configured, currently
confirmed with Big5 and GBK.

Upstream bug report:
http://trac.wordpress.org/ticket/5455